BigBlueButton, an open-source virtual classroom platform, contained a critical vulnerability prior to version 3.0.23. The vulnerability exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through ApiController.groovy, which was incorrectly implemented as a routable controller action instead of a private helper method. An attacker who could supply a valid existingUserID for an active meeting participant could hijack that participant's session and impersonate them within the same meeting. This constitutes a session impersonation/privilege escalation issue affecting meeting integrity and participant privacy. The vulnerability has been patched in BigBlueButton version 3.0.23 via a committed fix to the ApiController.groovy file. Organizations running BigBlueButton versions prior to 3.0.23 are advised to upgrade immediately to mitigate the risk of unauthorized session reuse and participant impersonation.
